PT-2004-3049 · Apple+1 · Cups+1

Published 2004-12-31 · Updated 2024-08-01 · CVE-2004-2154

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CUPS versions prior to 1.1.21rc1

Description The issue allows attackers to bypass intended Access Control Lists (ACLs) due to the case-sensitive treatment of a Location directive in cupsd.conf. This can be exploited via a printer name containing uppercase or lowercase letters that differ from what is specified in the directive.

Recommendations For versions prior to 1.1.21rc1, update to version 1.1.21rc1 or later to resolve the issue. As a temporary workaround, consider ensuring that all printer names and Location directives in cupsd.conf are specified with consistent case to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2004-2154

RHSA-2005:571

RHSA-2005_571

Affected Products

Cups

Red Hat

References · 16

• https://osv.dev/vulnerability/DEBIAN-CVE-2004-2154 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-2154 · Vendor Advisory
• http://cups.org/str.php?L700 · Patch
• http://ubuntu.com/usn/usn-185-1 · Vendor Advisory
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163274 · Vendor Advisory
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2154 · Security Note
• https://osv.dev/vulnerability/CVE-2004-2154 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_18_sr.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-571.html · Vendor Advisory
• https://redhat.com/security/data/cve/CVE-2004-2154.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9940 · Note
• https://t.me/cvenotify/71674 · Telegram Post
• https://t.me/cvenotify/88212 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2154 · Note